From: Manu Nicolas <e.nicolas@criteo.com>
Date: Tue, 1 Sep 2026 10:44:42 +0000 (+0000)
Subject: BUG/MINOR: resolvers: classify empty truncated responses
X-Git-Tag: v3.5-dev6~25
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=3b400190830c5ed9b99e616d23eb8f52937f10e8;p=haproxy.git

BUG/MINOR: resolvers: classify empty truncated responses

The answer count is checked before the response question is parsed.
Most DNS servers return a truncated response without answers, so such
a response is classified as ANCOUNT_ZERO before the TC flag and
question type are examined. It increments the wrong counter and hides
the actual response status.

Move the empty-answer check after question parsing and TC handling.
Truncated SRV responses keep their existing partial-answer behavior.

This should be backported as far as 2.4.
---

diff --git a/src/resolvers.c b/src/resolvers.c
index b4812f3a0..92c4567a0 100644
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -1091,10 +1091,6 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
 	if (reader + 2 > bufend)
 		goto invalid_resp;
 	r_res->header.ancount = reader[0] * 256 + reader[1];
-	if (r_res->header.ancount == 0) {
-		cause = RSLV_RESP_ANCOUNT_ZERO;
-		goto return_error;
-	}
 
 	/* Check if too many records are announced */
 	if (r_res->header.ancount > max_answer_records)
@@ -1157,6 +1153,11 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
 		goto return_error;
 	}
 
+	if (r_res->header.ancount == 0) {
+		cause = RSLV_RESP_ANCOUNT_ZERO;
+		goto return_error;
+	}
+
 	/* now parsing response records */
 	nb_saved_records = 0;
 	for (i = 0; i < r_res->header.ancount; i++) {